commit cae288b8d39605ea0386824e71550731fa259e1e
author Steven Moreland <smoreland@google.com> Mon Dec 30 22:18:59 2024 +0000
committer Steven Moreland <smoreland@google.com> Mon Dec 30 22:19:47 2024 +0000
tree 2532fd9bf45d8ab5e5e7c2c64ba373ef077b6e6b
parent b2361af7335ebc09e3dc18e160f3fc16881848bc

binder_parcel_fuzzer: add markSensitive coverage

Small change to improve fuzzing coverage on Parcel.

Bug: 369404061
Test: binder_parcel_fuzzer
Change-Id: I4acabf22dc4e7d2ad0b416f2dd02d8e04b1e5736

libs/binder/tests/parcel_fuzzer/binder.cpp

diff --git a/libs/binder/tests/parcel_fuzzer/binder.cpp b/libs/binder/tests/parcel_fuzzer/binder.cpp
index 07f0143..401c274 100644
--- a/libs/binder/tests/parcel_fuzzer/binder.cpp
+++ b/libs/binder/tests/parcel_fuzzer/binder.cpp
@@ -121,6 +121,11 @@
     PARCEL_READ_NO_STATUS(size_t, hasFileDescriptors),
     PARCEL_READ_NO_STATUS(std::vector<android::sp<android::IBinder>>, debugReadAllStrongBinders),
     PARCEL_READ_NO_STATUS(std::vector<int>, debugReadAllFileDescriptors),
+    [] (const ::android::Parcel& p, FuzzedDataProvider&) {
+        FUZZ_LOG() << "about to markSensitive";
+        p.markSensitive();
+        FUZZ_LOG() << "markSensitive done";
+    },
     [] (const ::android::Parcel& p, FuzzedDataProvider& provider) {
         std::string interface = provider.ConsumeRandomLengthString();
         FUZZ_LOG() << "about to enforceInterface: " << interface;

libs/binder/tests/parcel_fuzzer/random_parcel.cpp

diff --git a/libs/binder/tests/parcel_fuzzer/random_parcel.cpp b/libs/binder/tests/parcel_fuzzer/random_parcel.cpp
index dfd178a..61b9612 100644
--- a/libs/binder/tests/parcel_fuzzer/random_parcel.cpp
+++ b/libs/binder/tests/parcel_fuzzer/random_parcel.cpp
@@ -40,6 +40,13 @@
     const uint8_t fuzzerParcelOptions = provider.ConsumeIntegral<uint8_t>();
     const bool resultShouldBeView = fuzzerParcelOptions & 1;
     const bool resultShouldBeRpc = fuzzerParcelOptions & 2;
+    const bool resultShouldMarkSensitive = fuzzerParcelOptions & 4;
+
+    auto sensitivity_guard = binder::impl::make_scope_guard([&]() {
+        if (resultShouldMarkSensitive) {
+            outputParcel->markSensitive();
+        }
+    });
 
     Parcel* p;
     if (resultShouldBeView) {
@@ -49,6 +56,9 @@
     } else {
         p = outputParcel; // directly fill out the output Parcel
     }
+
+    // must be last guard, so outputParcel gets setup as view before
+    // other guards
     auto viewify_guard = binder::impl::make_scope_guard([&]() {
         if (resultShouldBeView) {
             outputParcel->makeDangerousViewOf(p);